This is a note to let you know that I've just added the patch titled
userns: Check euid no fsuid when establishing an unprivileged uid mapping
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
userns-check-euid-no-fsuid-when-establishing-an-unprivileged-uid-mapping.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 80dd00a23784b384ccea049bfb3f259d3f973b9d Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <[email protected]>
Date: Fri, 5 Dec 2014 18:26:30 -0600
Subject: userns: Check euid no fsuid when establishing an unprivileged uid
mapping
From: "Eric W. Biederman" <[email protected]>
commit 80dd00a23784b384ccea049bfb3f259d3f973b9d upstream.
setresuid allows the euid to be set to any of uid, euid, suid, and
fsuid. Therefor it is safe to allow an unprivileged user to map
their euid and use CAP_SETUID privileged with exactly that uid,
as no new credentials can be obtained.
I can not find a combination of existing system calls that allows setting
uid, euid, suid, and fsuid from the fsuid making the previous use
of fsuid for allowing unprivileged mappings a bug.
This is part of a fix for CVE-2014-8989.
Reviewed-by: Andy Lutomirski <[email protected]>
Signed-off-by: "Eric W. Biederman" <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/user_namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -819,7 +819,7 @@ static bool new_idmap_permitted(const st
u32 id = new_map->extent[0].lower_first;
if (cap_setid == CAP_SETUID) {
kuid_t uid = make_kuid(ns->parent, id);
- if (uid_eq(uid, file->f_cred->fsuid))
+ if (uid_eq(uid, file->f_cred->euid))
return true;
}
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.18/mnt-update-unprivileged-remount-test.patch
queue-3.18/mnt-fix-a-memory-stomp-in-umount.patch
queue-3.18/userns-check-euid-no-fsuid-when-establishing-an-unprivileged-uid-mapping.patch
queue-3.18/mnt-implicitly-add-mnt_nodev-on-remount-when-it-was-implicitly-added-by-mount.patch
queue-3.18/userns-don-t-allow-unprivileged-creation-of-gid-mappings.patch
queue-3.18/userns-rename-id_map_mutex-to-userns_state_mutex.patch
queue-3.18/userns-add-a-knob-to-disable-setgroups-on-a-per-user-namespace-basis.patch
queue-3.18/userns-allow-setting-gid_maps-without-privilege-when-setgroups-is-disabled.patch
queue-3.18/userns-don-t-allow-setgroups-until-a-gid-mapping-has-been-setablished.patch
queue-3.18/groups-consolidate-the-setgroups-permission-checks.patch
queue-3.18/userns-only-allow-the-creator-of-the-userns-unprivileged-mappings.patch
queue-3.18/userns-document-what-the-invariant-required-for-safe-unprivileged-mappings.patch
queue-3.18/umount-disallow-unprivileged-mount-force.patch
queue-3.18/userns-unbreak-the-unprivileged-remount-tests.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
